From: Subash Abhinov Kasiviswanathan <subas...@codeaurora.org>
Date: Tue, 10 Sep 2019 14:02:57 -0600
> In event of failure during register_netdevice, free_netdev is
> invoked immediately. free_netdev assumes that all the netdevice
> refcounts have been dropped prior to it being called and as a
> result frees and clears out the refcount pointer.
>
> However, this is not necessarily true as some of the operations
> in the NETDEV_UNREGISTER notifier handlers queue RCU callbacks for
> invocation after a grace period. The IPv4 callback in_dev_rcu_put
> tries to access the refcount after free_netdev is called which
> leads to a null de-reference-
...
> Fix this by waiting for the completion of the call_rcu() in
> case of register_netdevice errors.
>
> Fixes: 93ee31f14f6f ("[NET]: Fix free_netdev on register_netdev failure.")
> Cc: Sean Tranchetti <stran...@codeaurora.org>
> Signed-off-by: Subash Abhinov Kasiviswanathan <subas...@codeaurora.org>
Applied and queued up for -stable.
